Wednesday Nov 25, 2009

Identity in the Browser, Firefox style

Mozilla's User Interface chief Aza Raskin just put forward some interesting thoughts on what Identity in the Browser could look like for Firefox. As one of the Knights in search of the Golden Holy Grail of distributed Social Networking, he believes to have found it in giving the browser more control of the user's identity.

The mock up picture reproduced below, shows how Firefox, by integrating identity information into the browser, could make it clear as to what persona one is logged into a site as. It would also create a common user interface for allowing one to log in to a site under a specific Identity, as well as allow one to create a new one. Looking at the Weave Identity Account Manager project site one finds that it would also make it easy to generate automatically passwords for each site/identity, to sync one's passwords across devices, as well as to change the passwords for all enabled sites simultaneously if one feared one's computer had fallen in the wrong hands. These are very appealing properties, and the UI is especially telling, so I will reproduce the main picture here:

The User Interface

One thing I very strongly support in this project is the way it makes it clear to the user, in a very visible location - the URL bar -, as what identity he is logged in as. Interestingly this is at the same location as the https information bar, when you connect to secure sites. Here is what URL bar looks like when connected securely to LinkedIn:

One enhancement the Firefox team could immediately work on, without inventing a new protocol, would be to reveal in the URL bar the client certificate used when connected to a https://... url. This could be done in a manner very similar to the way proposed by Aza Raskin in the his Weave Account manager prototype pictured above. This would allow the user to

  • know what HTTPS client cert he was using to connect to a site,
  • as well as allow him to log out of that site,
  • change the client certificate used if needed
The last two feature of TLS are currently impossible to use in browsers because of the lack of such a User Interface Handle. This would be a big step to closing the growing Firefox Bug 396441: "Improve SSL client-authentication UI".

From there it would be just a small step, but one that I think would require more investigation, to foaf+ssl enhance the drop down description about both the server and the client with information taken from the WebID. A quick reminder: foaf+ssl works simply by adding a WebID - which is just a URL to identify a foaf:Agent - as the subject alternative name of the X509 certificate in the version 3 extensions, as shown in detail in the one page description of the protocol. The browser could then GET the meaning of that URI, i.e. GET a description of the person, by the simplest of all methods: an HTTP GET request. In the case of the user himself, the browser could use the foaf:depiction of the user, to display a picture of him. In the case of the web site certificate, the browser could GET the server information at its WebId, and display the information placed there. Now if the foaf file is not signed by a CA, then the information given by the remote server about itself, should perhaps be placed on a different background or in some way to distinguish the information in the certificate, from the information gleaned from the WebId. So there are a few issues to work on here, but these just only involve well developed standards - foaf and TLS - and some user interface engineers to get them right. Easier, it seems to me, than inventing a whole protocol - even though it is perhaps every engineers desire to have developed a successful one.

The Synchronization Piece

Notice how foaf+ssl enables synchronization. Any browser can create a public/private key pair using the keygen element, and get a certificate from a WebId server, such as foaf.me. Such a server will then add that public key as an identifier for that WebId to the foaf file. Any browser that has a certificate whose public key matches that published on the server, will be able to authenticate to that server and download all the information it needs from there. This could be information

  • about the user (name, depiction, address, telephone number, etc, etc)
  • a link to a resource containing the bookmarks of the user
  • his online accounts
  • his preferences
Indeed you can browse all the information foaf.me can glean just from my public foaf file here. You will see my bookmarks taken from delicious, my tweets and photos all collected in the Activity tab. This is just one way to display information about me. A browser could collect all that information to build up a specialized user interface, and so enable synchronization of preferences, bookmarks, and information about me.

The Security Problem

So what problem is the Weave team solving in addition to the problem solved above by foaf+ssl?

The weave synchronization of course works in a similar manner: data is stored on a remote server, and clients fetch and publish information to that server. One thing that is different is that the Weave team wish to store the passwords for each of the user's accounts onto a remote server that is not under the user's control. As a result that information needs to be encrypted. In foaf+ssl only the public key is stored on a remote server, so there is no need to encrypt that information: the private key can remain safely on the client key chain. Of course there is a danger with the simple foaf+ssl server that the owner of the remote service can both see and change the information published remotely depending on who is asking for it. So an unreliable server could add a new public key to the foaf file, and thereby allow a malicious client to authenticate as the user in a number of web sites.

It is to solve this problem that Weave was designed: to be able to publish remotely encrypted information that only the user can understand. The publication piece uses a nearly RESTful API. This allows it to store encrypted content such as passwords, identity information, or indeed any content on a remote server. The user would just need to remember that one password to be able to synchronize his various Identities from one device to another. There is a useful trick that is worth highlighting: each piece of data is encrypted using a symmetric key, which is stored on the server encrypted with a public key. As a result one can give someone access to a piece of data just by publishing the symmetric key encrypted using one of her public key.

Generalization of Weave

To make the above protocol fully RESTful, it needs to follow Roy Fielding's principle that "REST APIs must be hypertext driven". As such this protocol is failing in this respect in forcing a directory layout ahead of time. This could be fixed by creating a simple ontology for the different roles of the elements required in the protocol: such as public keys, symmetric keys, data objects, etc... This would then enable the Linked Data pattern. Allowing each of the pieces of data to be anywhere on the web. Of course nothing would stop the data from being set out the way specified in the current standard. But it immediately opens up a few interesting possibilities. For example if one wanted a group of encrypted resources to be viewed by the same group of people, one would need only one encrypted symmetric key each of those resources could point to, enabling less duplication.

By defining both a way of getting objects, and their encoding, the project is revealing its status as a good prototype. To be a standard, those should be separated. That is I can see a few sperate pieces required here:

  1. An ontology describing the public keys, the symmetric keys, the encrypted contents,...
  2. Mime types for encrypted contents
  3. Ontologies to describe the contents: such as People, bookmarks, etc...
Only (1) and (2) above would be very useful for any number of scenarios. The contents in the encrypted bodies could then be left to be completely general, and applied in many other places. Indeed being able to publish information on a remote untrusted server could be very useful in many different scenarios.

By separating the first two from (3), the Weave project would avoid inventing yet another way to describe a user for example. We already have a large number of those, including foaf, Portable Contacts, vcard, and many many more... I side for data formats being RDF based, as this separates the issues of syntax and semantics. It also allow the descriptions to be extensible, so that people can think of themselves in more complex ways that that which the current developers of Weave have been able to think of. That is certainly going to be important if one is to have a distributed social web.

Publishing files in an encrypted manner remotely does guard one from malicious servers. But it does I think also reduce the usability of the data. Every time one wants to give access to a resource to someone one needs to encrypt the symmetric key for that user. If the user looses his key, one has to re-encrypt that symmetric key. By trusting the server as foaf+ssl does, it can encrypt the information just in time, for the client requesting the information. But well, these are just different usage scenarios. For encrypting password - which we should really no longer need - then certainly the Weave solution is going in the right direction.

The Client Side Password

Finally Weave is going to need to fill out forms automatically for the user. To do this again I would develop a password ontology, and then markup the forms in such a way that the browser can deduce what pieces of information need to go where. It should be a separate effort to decide what syntax to use to markup html. RDFa is one solution, and I hear the HTML5 solution is starting to look reasonable now that they removed the reverse DNS namespace requirement. In any case such a solution can be very generic, and so the Firefox engineers could go with the flow there too.

RDF! You crazy?

I may be, but so is the world. You can get a light triple store that could be embedded in mozilla, that is open source, and that is in C. Talk to the Virtuoso folks. Here is a blog entry on their lite version. My guess is they could make it even liter. KDE is using it....

Tuesday Nov 24, 2009

my time at Sun is coming to an end

Many have been laid off at Sun over the past few years, and we are in a new round now in France: it looks like it may be my turn next.

I am lucky to be working from Europe where these things take quite some time to be processed. There may be even some way I can extend my pay for 3 months, if I volunteer to depart, and don't take some time to find another job inside of Sun. In France people don't get fired, unless they did something really bad - their jobs are terminated.

I have known this was on the cards for the past 6 months, and so I had really hoped that the Social Web Camp in Santa Clara would help me demonstrate the value of what I had been doing to a larger cross section of people in the Bay Area. Sadly that was messed up by the decision by the SFO Homeland Security bureaucrats to send me to jail instead; a very interesting experience with hindsight, that has triggered a number of new interests, that could well guide me to a radical departure of my career as writer, sociologist, psychologist, political scientist. So many interesting things to do in life...

My time at Sun has certainly been the best experience of work I have ever had. I learned so much here. Certainly, I would have preferred it if we could have launched a large and successful semantic web project while I was here, but somehow that just seemed to be a very elusive task. My hope was to simplify the Semantic Web down to a core, and to show how there is a tremendous opportunity in distributed Social Networks. But Sun's current financial difficulties and the uncertainties of the takeover by Oracle, have meant that the company had to focus more on its core business. Much bigger projects have failed, and many much better engineers have lost their job here.

Still this means that I am a bit in limbo now. I will certainly continue to work on Decentralized Social Networks (esp, foaf+ssl), as I believe these have a huge potential. But even more so that over the past few months, I will be doing this under my own steam.

Sunday Sep 20, 2009

Social Web Bar Camp in Paris

social web bar camp program drawn up on the black board

After flying in from Berlin on Friday and celebrating the Jewish new year late into the night with Ori Pekelman, I woke up earlyish on Saturday to go to the Social Web Bar Camp organized in and by La Cantine, the very friendly Parisian conference, community, meeting space for creative people in the digital age.

At 10am the conference started and people slowly arrived for the freely available espresso coffee and pastries. The conference was free too, being sponsored by the member organizations of La Cantine. At 10:20am as the coffee had worked itself into the 60 or more attendees, Ori started the workshop (picture) by having everybody introduce themselves shortly by name and 3 tags. The Bar Camp rules of the game were then explained:

  • Everybody is a participant
  • You make the event
  • Feel free to move between sessions if you feel you are not getting what you were looking for at one of them
  • Write up your interests on the black board, this will be used to create the time table.
So the sessions were put together on the spot there and then.

Of course I put up a session on foaf+ssl and Distributed Social Networks on the black board, for the session starting at 11am.

After a last coffee, a little over 20 people gathered in the room. I connected the laptop to the projector, introduced myself and the W3C Social Web XG, before starting the presentation (slides in pdf) which I have been giving in various universities and hacker spaces around Europe for the past 5 months. (see the FrOSCon video for example)

picture of the discussion in the foaf+ssl session

A round table discussion of this size has a very different dynamic to conference presentations. It is a lot more free flowing and people can ask question and did as I went through the presentation, leading to lively discussions on security, identity and web architecture. At times it seemed in danger of veering off into widely philosophical discussions, but somehow we always got back to the topic helped by the real implementations of foaf+ssl that are now available. Somehow we did in fact manage to complete covering the subject by 12:30 including an excursion into a description of the very real business opportunities this enables.

From the twitter posts (tagged #swcp) and the invitations to follow up with other French public and private institutions that I got over the course of the day, I can only say that this conference was a great success. I could not have started my 1 month stay in Paris in a better way. I will clearly be very busy during the coming month, before my return to Berlin.

Thanks to Huges M for the photos. More of his pictures are available on his flickr account under the #swcp tag.

Further pointers

Monday Sep 14, 2009

Freiheit statt Angst - Freedom, not fear

Freiheit statt Angst photos

This weekend in Berlin, 20 thousand people, from most political backgrounds, came to protest against increasingly intrusive and worrying surveillance measures of all kinds, made possible by modern information technology, under the banner Freiheit statt Angst. As governments and businesses automate the collection of information about individuals, worries are starting to grow about how that information could be used. In Germany for example the request by the government that the ISPs keep records of the mail headers of all the communications between people for 6 months, was among one of the major motivators bringing people out. The growing use of video surveillance cameras - not as bad as in the UK here, though they were clearly lining the street along the road of the demonstration - is another vector of resentment. Electronic RFID enabled passports containing personal information readable at a distance and being put into operation soon, generate a lot of worries, quite understandable, especially after listening to Chris Paget's RFID cloning presentation. The German Chaos Computer Club has further pages undermining the use of these technologies, such as the article "How to fake fingerprints" where you can learn how to capture fingerprints left over on a glass, make a copy of it, and duplicate it anywhere you choose. Others are worried about the creation of centralised medical data banks, citing the cases where massive amounts of data have been lost by companies directly involved in telecommunication infrastructure, such as when the information of 17 million T-mobile customers was stolen. If telecoms companies can't secure their data, who will be able to do it? These and many other cases bringing issues of privacy, security and data ownership are fueling a debate that is strong enough to move 20 thousand people to the street: quite a feat, considering the abstract nature of the debate.

The following video covers the issues from a German perspective very well (an english version will be available here soon)

If these issues sound remarkably like those arising in France, the UK, and other European Countries, it is that the movement for internet rights is a global phenomenon, reacting to technological problems that span borders as the July/August issue of Internationale Politik argues. Clearly these topics need to be debated in much more depth and with much more seriousness, by involving much larger sections of the community. One just cannot magically solve complex problems with misguided laws, however comforting it may seem at first to be. Bad solutions introduced in a climate of fear, can only grow the insecurity and mistrust between citizens, governments and business. With Germany's historical proximity to both fascist and communist surveillance regimes, these issues of trust are alive and healthy here. Hopefully other countries won't be misled by their distance to such horrors into thinking that it cannot happen to them. The only solution is active participation in the debate.

Here are some photos I took from the roof of the Green bus which gives a good idea of the size of the protest. You can clearly see the large Pirate Party bus at the back, with their Orange banner, the Red Left convoy, the CCC bus covered with video surveillance cameras, and their Federal Trojan Horse, with the sign "watch the watchmen!"

Schauble-Freie Zone Start of "Freiheit Statt Angst" demo CCC camera truck Pirate Party Pirate Party

IMG_0413 Noch kein terrorist "überwacht die überwacher" on the Federal Trojan horse green drum beat

The Green party was escorted by some of the top Green politicians

Ströbele and Claudia Roth at "Freiheit Statt Angst" IMG_0419 stasi 2.0: Vollbeschaftigung durch vollüberwachung

The large Anti-Fascist convoy was ironically the most escorted by the police. Perhaps the use of face covering masks, illegal in Germany for citizens, though not it seems for the police, was what attracted the security forces. Their presence certainly formed a good symbol of the problem between privacy, public statement, anonymity, and surveillance.

Break out of Control

Add to that the fact that there were close to a thousand police officers for a demonstration the police claimed had attracted only 10 thousand individuals, and we have a police to demonstrator ration of 1/10, which goes only to increase the surveillance message. As the following photos show quite clearly the demonstration was peaceful. Put 20 000 geeks on the road on a sunny day, and you get something like this:

Nur Diktatur braucht Zensur you will wish we were apolical potentially troublemaking citizen IMG_0428 Sammel album 2.0
IMG_0430 IMG_0431 IMG_0432 My info belongs to me todo list IMG_0436
Löschen statt sperren who watches the watchmen freiheit statt angst It is your feat, but it is our freedom Freiheit Statt Angste - Die Linke Fretiheit Statt Angst
The data tentacles Big Boss is watching you Against the state of surveillance

The result in the press was quite positive. Here are some of the articles I gathered from following Twitter #fsa09 tag for a few minutes:

One story that made the round of Twitter, the blogosphere and the news was the following incident of police brutality captured by a demonstrator on video:

[Update Tuesday 15 September: It seems this incident was provoked by a demonstrator asking the police for their Identification number, which they are obliged to give, but which they don't like handing out, preferring to treat those who ask for it as troublemakers. This is a long standing issue as the following article "Anonymität schützt Polizisten" - Anonymity protects the police explains. So in short the police themselves and the state by extension are very keen on anonymity, but refuse the same for the demonstrators and the public which is being placed every day under increasing surveillance measures. Luckily the attack was caught on High Definition video by a member of the Chaos Computer Club, helping identify the police who committed the excess. This resulted in the CCC publishing the following press release "Chaos Computer Club fordert bundeseinheitliche Nummernschilder für Polizisten": CCC calls for nationwide number plates for Police.]

Clearly then the same tools that can be used to create a surveillance society, can also be used when distributed to the citizenry as a means of watching the watchmen. Perhaps that is the lesson of the demonstration: the need to reduce the asymmetry of surveillance technology. It should be understood that Kant's Categorical Imperative - "act only according to that maxim whereby you can at the same time will that it should become a universal law" - applies especially to legislation. If you want to watch others don't be surprised if they then watch back. If you want anonymity, don't refuse it to others.

Update

Thursday Aug 20, 2009

Camping and Hacking at HAR2009

HAR2009 logo

On Monday 10 August evening I arrived under a light drizzle in Vierhouten in the Netherlands, after cycling the last 100km section of the 300km that I had traveled from the University of Koblenz. I just had time for a beer and a soup, as the c-base bus arrived from Berlin. Night was falling fast, and so we all got together and helped put up the large colorful tent on the edge of a still mostly empty field. The BSD camp next to us had worked out how to get some electricity and kindly let us have enough to power a lamp and a couple of laptops. So we could relax and listen to some music, as it got colder.

I travel very light weight on my bicycle for obvious reasons. So I don't carry a tent with me. Instead I go from hotel, to youth hostel, to family couch. I have not tried the Couch surfing network yet, but it's an extra option I could use. Here on the camp, in the middle of the forest, none of the options were available. So I was very grateful to Dirk Höschen for having taken a nice tent with him for me to sleep in, and also to Rasta for having given me some blankets and furs he happened to have to sleep on. The thick down coat I had carried with me from France, finally came in useful, in the cold nights that followed.

C-base tent at HAR2009
(the tent to the right was the one I slept in)

HAR (Hacking At Random) is an international technology and security conference, with a strong free software, freedom of information political leaning. I had not heard of it until I reached Berlin, but was told so much good about it from so many different people, that I was convinced to go. I was lucky to get some last minute tickets, from some friends of a friend from the Viennese Metalab who could not make it. The 2000 tickets had all been sold out a month ago. Needless to say I had largely missed the deadlines for submitting a presentation. The organisers though were interested enough in what I was presenting on Distributed Social Networks that they gave me a couple of 2 hour workshop sessions to present. The first one of them was filmed, but I am not sure where the video is yet. (I'll update this when I get a link to it.) On Saturday I was lucky to get a 10 minute slot on the Lightening Talks track. This was recorded (slides here)

(( Mhh, one learns a lot from being filmed. I was not so aware how much I gesticulate with my hands. Something I picked up in France I think, but without the french mastery...))

Given how foaf+ssl builds up on X509 and relies on existing Internet infrastructure this conference was an excellent place to come to and learn the latest on holes and limitations in these technologies. Perhaps the most relevant talk was the one given by Dan Kaminsky x509 considered harmful, which he gave while downing a bottle of excellent whiskey - as I found out while talking to him after the presentation.

In his talk Dan really beats home the importance of DNSSEC, the next version of DNS which is about to get a lot higher profile as the root DNS server moves over to it at the end of this year. The x509 problems could mostly disappear with the rollout of DNSSEC, which is good for me, because it means we can continue working on foaf+ssl. Also foaf+ssl relies a lot less on Certificate Authorities. The only place where that is important is for server authentication (which is where DNSSEC comes in). Client certificates can be self signed as far as foaf+ssl is concerned.

If there was a main theme I got from this conference, then it was clearly the importance of the deployment of DNSSEC. It may be a lot more heavy weight, and a lot more complex than what we have currently, but the problems are getting to be so big, that it is unavoidable. For a good presentation of these issues see Bert Hubert's talk, the man behind PowerDNS:

For an overview/introduction of what DNSSEC is, how it functions and what problems it solves, see Rick Van Rein's presentation Cracking Internet: the urgency of DNSSEC.

Sun Microsystems is also supporting the DNSSEC effort. In this security alert, you can read

Note 1: The above patches implement mitigation strategies within the implementation of the DNS protocol, specifically source port randomization and query ID randomization making BIND 9 more resilient to an attack. It does not, however, completely remove the possibility of exploitation of this issue.

The full resolution is for DNS Security Extensions (DNSSEC) to be implemented Internet-wide. DNS zone administrators should start signing their zones.

If your site's parent DNS zone is not signed you can register with the ISC's DNSSEC Look-aside Validation (DLV) registry at the following URL:

https://secure.isc.org/ops/dlv/

Further details on configuring your DNA zones for DNSSEC is available from the ISC at the following URL:

http://www.isc.org/sw/bind/docs/DNSSEC_in_6_minutes.pdf

The issues addressed by these talks are not just technical, they have political implications for how we live. There were many good talks on the subject here at HAR, but my favorite, perhaps because I followed the story in France so carefully, was the one given by Jéremie Zimmermann co-founder of Quadrature du Net a French site with an English translation, that does an excellent job tracking the position of French and European politicians on issues related to web freedom. Jeremie's talk on Hacking the Law was on Sunday noon, the last day of the talk, and there were some technical problems getting the projectors to work. The best way to get it for the moment is to download it from the command line

curl -o jeremie.ogv ftp://ftp.sickos.org/pub/HAR2009/room1/r1-filer.20090816-115405.ogv
And view in in your favorite ogg viewer. I think the talk starts around the 20th minute.

The talks will hopefully be placed online soon in an easier to access manner.

But HAR2009 was not just about talks. It was also about meeting people, talking, exchanging ideas. Some of the best parties were organised by the Chaos Computer Club a German wide hacker's club that deals with security and political issues, and that is widely referenced by the German media, when in need of enlightenment. They had a great tent with an excellent view of a pond, and at night had excellent DJs to create just the right ambiance to meet people. Mix that together with some Tschunk a cocktail of Club-Mate - the Germanic hacker drink - and Rum, and I found it difficult to go to sleep before 4am.

On Monday morning I cycled the remaining 100km to Amsterdam, one of the most easy going, beautiful towns in Europe, where I am writing this.

Thursday Jun 11, 2009

The foaf+ssl world tour

As you can see from the map here I have been cycling from Fontainebleau to Vienna (covering close to 1000km of road), and now around Cyprus in my spare time. On different occasions along my journey I had the occasion to present foaf+ssl and combine it with a hands on session, where members of the audience were encouraged to create their own foaf file and certificates, and also start looking into what it takes to develop foaf+ssl enabled services. This seems like a very good way to proceed: it helps people get some hands on experience which they can then hopefully pass on to others, it helps me prioritize what need to be done next, and should also lead to the development of foaf+ssl services that will increase the network value of the community, creating I hope a viral effect.

I started this cycle tour in order to loose some weight. I still have 10kg to loose or so, which at the rate of 3kg per 1000km will require me to cycle another 3000km. So that should enable me to visit quite a few places yet. I will be flying back to Vienna where I will stay 10 days or so, after which I will cycle to Prague for a Kiwi meeting on the 3rd of July. After that I could cycle on to Berlin. But really it's up to you to decide. If you know a good hacker group that I can present to and cycle to, let me know, and I'll see how I can fit it into my timetable. So please get in contact! :-)

Friday Apr 03, 2009

Global Identity in the iPhone browser

Typing user name/passwords on cell phones is extreemly tedious. Here we show how identification & authentication can be done in two clicks. No URL to type in, no changes to the iPhone, just using bog standard SSL technology tied into a distributed global network of trust, which is known as foaf+ssl.

After having installed a foaf+ssl certificate on my phone (which I will explain how to do in my next post), I directed Safari to foaf.me, which is a foaf+ssl enabled web site. This brought up the following screen:

empty foaf.me page

This is a non personalised page. In the top right is a simple foaf+ssl login button. This site was not designed for the iPhone, or it would have been a lot more prominent. (This is easy to change for foaf.me of course). So I the zoomed onto the login link as shown in the following snapshot. Remember that I don't have an account on foaf.me. This could be the first time ever I go there. But nevertheless I can sign up: just click that link.

login link

So clicking on this foaf+ssl enabled link brings up the following window in Safari. Safari warns me first that the site requires a certificate. The link I clicked on sent me to a page that is requesting my details.

certificate warning

As I do in fact want to login, I click the continue button. The iPhone then presents me with an identity selector, asking me which of my two certificates I want to use to log in:

certificate selection

Having selected the second one, the certificate containing my bblfish.net WebId is sent to the server, which authenticates me. The information from my foaf file is then used to personalise my foaf.me experience. Here foaf.me gives me a nice human readable view of my foaf file. I can even explore my social network right there and then, by clicking on the links to my friends. Again, this will work even if you never did go to foaf.me before. All you need is of course a well filled out foaf file, which services such as foafbuilder.qdos.com are making very easy to do. Anyway, here is the foaf.me personalised web page. It really knows a lot about me after just 2 clicks!

personalised foaf.me

The foaf.me site currently has another tab, showing my activity stream of all the chats I have on the web, which it can piece together since I linked all my accounts together in my foaf file, as I explained in the post "Personalising my Blog" a few months ago.

activity stream

Other web sites could use this information very differently. My web server itself may also decide to show selected information to selected servers... Implementing this is it turns out quite easy. More on that on this blog and on the foaf-protocols mailing list.

Wednesday Jan 21, 2009

Outline of a business model for open distributed social networks

illustration of SN data silos by the Economist

The organisers of the W3C Workshop on the future of social networking had the inspiration to include a track on Business Models. What would be the interest of large players to open up? to play ball in a larger ecosystem of social networks? What would the business model be for new entrants? This question clearly was on many of the attendees minds, and it is one I keep coming across.

First without Linked Social Networks there are a lot of disincentives to create new web services. This is because users of these services need to duplicate the data they have already created elsewhere, and also because the network effect of the data they are using is bound to be much smaller. I have found myself uninterested in trying out many new web 2.0 offerings for just these reasons. It is much more rewarding for developers to create applications for the Facebook platform for example, where the users just need to click a button to try out the application on the data they are already using, and that may yet enrich this data further.

Open Secure Linked Social Networks, such as that made possible by foaf+ssl, give one the benefits enjoyed by application developers of the closed social networks but in a distributed space, which should allow the unleashing of a huge amount of energy. Good for the consumer. But good for the big network players? I will argue that they need consider the opportunities this is opening up.

First of all one should notice that the network effect applies just as much to the big players as to the small ones. A growing distributed social network (SN) is a tide that will lift all boats, and since metcalf's law states that the value of the network grows exponentially with the number of nodes in it, then doubling the number of nodes in the network may just quadruple the value of the network to all. Perhaps the big operators are thinking that they control such a large slice of the market that there is not much doubling that they can do by linking to the smaller players. As it happens most social networks are geographical monopolies, which would go to strengthen that point of view (see slide 8 of the opening presentation at the W3C workshop). [ Nothing stays still, and everyone should watch out for the potential SN controlled by the telecoms.]

But the network effect applies to the big players also in another way. Namely that if they wish to create small networks then the value of those networks will be just as insignificant as those of other smaller players. So let me take a simple example of very valuable smaller networks which have a huge and unsatisfied demand for social networking technologies and the money to pay for tools that could help them quench their need: companies! Companies need to connect their employees to their managers and colleagues inside the same company, to knowledge resources, to paychecks and many other internal resources such as wikis, blogs, etc... Usually companies of a large enough size have software to deal with these. But even in a company such as Sun Microsystems, that is relatively large, the network effect of that information is not interesting enough for people to participate gladly in keeping the information up to date. I often find it easier to go to Facebook to find a picture of someone in Sun. Why? Well there is a very large value in adding one's picture to facebook: 200 million other users to connect to. In Sun Microsystems only 34 thousand people to connect to, and it is true a financial incentive. Clearly the value of 200 million squared is larger than the incentive of being efficient at work.

One thing is clear: it is impossible to imagine that such large software companies can allow their employees to just use the closed SN sites directly to do their work - I mean here: have all their employess just use the tools on facebook.com for example. This would give those SN companies way too much insight into the dealings of the company. Certainly very large sections of industry, including defence contractors, large competitive industries such as car manufacturers, and governments, cannot legally and strategically permit such outsourcing to happen, even though the value of the information in such a large network would be astronomically larger. In some case there are serious privacy and security issues that just cannot be ignored however attractive the value calculation is.

So large SN players would have to enter the Fortune 1000 with Social Networking software that did not leak information. But in that case they won't be in any seriously better position than the software that is already in there, and they won't be able to compete any better than any of the smaller companies that are working in this space, as they will not find it easy to leverage their main advantage, namely the network effect of their core offering.

And even if they did manage to leverage this in some ways, they would find it impossible to leverage that advantage in the ways that really count. Companies don't just want their employees to link up with their colleagues, they need them to link up with people outside their company, be it customers, government agencies, researchers, competitors, external contractors, local governement, insurance or health agencies, etc, etc..... The list is huge. So even if a large Social Network could convince one of these players of the advantage of their offering, they will never be able to convince every single partner of that company - for that would be to convince the whole world. Companies really want global SN, and that is what Emergency Response teams really need.

To make such a globaly linkable platfrom a reality one needs to build at the level of abstraction and clarity at which the only such global network in existence is built: the web itself. By using Linked Data one can create distributed social networks where each player can maintain the information they feel the business need to maintain. With the very simple foaf+ssl protocol we have the lightest possible means to build security into a distributed social network. Simplicity and clarity - mathematical clarity - is essential when developing something that is to grow to a global scale.

Companies therefore that work at providing tools for distributed social networks, will if they play well together, find a huge opportunity opening up in front of them in helping enterprises in every industry segment link up their employees to people in every walk of life.

Thursday Jan 15, 2009

The W3C Workshop on the Future of Social Networking Position Papers

picture by Salvadore Dali

I am in Barcelona, Spain (the country of Dali) for the W3C Workshop on the Future of Social Networking. To prepare for this I decided to read through the 75 position papers. This is the conference I have been the best prepared for ever. It really changes the way I can interact with other attendees. :-)

I wrote down a few notes on most paper I read through, to help me remember what I read. This took me close to a week, a good part of which I spent trying to track down the authors on the web, find their pictures, familiarise myself with their work, and fill out my Address Book. Anything I could do to help me find as many connections as possible to help me remember the work. I used delicious to save some subjective notes, which can be found on under the w3csn tag. I was going to publish this on Wednesday, but had not quite finished reading through all the papers. I got back to my hotel this evening to find that Libby Miller, who co-authored the foaf ontology, had beat me to it with the extend and quality of her reviews which she published in a two parts:

Amazing work Libby!

70 papers is more than most people can afford to read. If I were to recommend just a handful of papers that stand out in my mind for now these would be:

  • Paper 36 by Ching-man Au Yeung, Laria Liccardi, Kanghao Lu, Oshani Seneviratne and Tim Berners Lee wrote the must read paper entitled "Decentralization: The Future of Online Social Networking". I completely agree with this outlook. It also mentions my foaf+ssl position paper, which of course gives it full marks :-) I would use "distribution" perhaps over "decentralisation", or some word that better suggests that the social network should be able to be as much of a peer to peer system as the web itself.
  • "Leveraging Web 2.0 Communities in Professional Organisations" really prooves why we need distributed social networks. The paper focuses on the problem faced by Emergency Response organisation. Social Networks can massively improove the effectiveness of such responses, as some recent catastrophes have shown. But ER teams just cannot expect everyone they deal with to be part of just one social network silo. They need to get help from anywhere it can come from. From professional ER teams, from people wherever they are, from infromation wherever it finds itself. Teams need to be formed ad hoc, on the spot. Not all data can be made public. Distributed Open Secure Social Networks are what is needed in such situations. Perhaps the foaf+ssl proposal (wiki page) can help to make this a reality.
  • In "Social networking across devices: opportunity and risk for the disabled and older community", Henni Swan explains how much social networking information could be put to use to help make better user interface for the disabled. Surprisingly enough none of the web sites, so taken by web 2.0 technologies, seem to put any serious, effort in this space. Aparently though this can be done with web 2.0 technologies, as Henny explains in her blog. The semantic Web could help even further I suggested to her at her talk today, by splitting the data from the user interface. Specialised browsers for the disabled could adapt the information for their needs, making it easy for them to navigate the graph.
  • "Trust and Privacy on the Social Web" starts the discussion in this very important space. If there are to be distributed social networks, they have to be secure, and the privacy and trust issues need to be looked at carefully.
  • On a lighter note, Peter Ferne's very entertaining paper "Collaborative Filtering and Social Capital" comes with a lot of great links and is a pleasure to read. Did you know about the Whuffie Index or CELEBDAQ? Find out here.
  • Many of the telecoms papers, of which Telefonica's "The social network behind telecom networks" reveal the elephant in the room that nobody saw in social networking: the telecoms. Who has the most information about everyone's social network? What could they do with this information? How may people have phones, compared to internet access? Something to think about.
  • Nokia's position paper can then be seen in a different light. How can handset manufacturers help put to use the social networking and location information contemporay devices are able to access? The Address Book in cell phones is the most important application in a telephone. But do people want to only connect to other Nokia users? This has to be another reason for distributed social networks.

    I will blog about other posts as the occasion presents itself in future blogs. This is enough for now. I have to get up early and be awake for tomorrow's talks which start at 8:30 am.

    In the mean time you can follow a lively discussion of the ongoing conference on twitter under the w3csn tag.

  • About

    bblfish

    Search

    Archives
    « April 2014
    MonTueWedThuFriSatSun
     
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
        
           
    Today